Snowden: NSA Was Building 'Automated' System To Hit Back At Perceived Cyberattacks

from the bad-ideas dept

One final story to highlight from James Bamford's really wonderful Wired profile of Ed Snowden. This one might not be that surprising, but the NSA was building an internal automated "cyberwar" system called MonsterMind, which would seek to detect an incoming "cyber attack" and then automatically launch a counterattack. Here's how Bamford describes Snowden's explanation in his article:

The massive surveillance effort was bad enough, but Snowden was even more disturbed to discover a new, Strangelovian cyberwarfare program in the works, codenamed MonsterMind. The program, disclosed here for the first time, would automate the process of hunting for the beginnings of a foreign cyberattack. Software would constantly be on the lookout for traffic patterns indicating known or suspected attacks. When it detected an attack, MonsterMind would automatically block it from entering the country—a “kill” in cyber terminology.

Programs like this had existed for decades, but MonsterMind software would add a unique new capability: Instead of simply detecting and killing the malware at the point of entry, MonsterMind would automatically fire back, with no human involvement.

Yeah, because false alarms never happen at all. Hell, just this week I was hearing about a series of false alarms when the US thought that Russia had launched thousands of nuclear missiles at the US. Imagine an automated system taught to respond to that?

And, of course, this only works... if the NSA has access to private company's networks:

In addition to the possibility of accidentally starting a war, Snowden views MonsterMind as the ultimate threat to privacy because, in order for the system to work, the NSA first would have to secretly get access to virtually all private communications coming in from overseas to people in the US. “The argument is that the only way we can identify these malicious traffic flows and respond to them is if we’re analyzing all traffic flows,” he says. “And if we’re analyzing all traffic flows, that means we have to be intercepting all traffic flows. That means violating the Fourth Amendment, seizing private communications without a warrant, without probable cause or even a suspicion of wrongdoing. For everyone, all the time.”

This puts into context some stories from last year, which noted that Keith Alexander seemed particularly focused on getting companies to give the NSA access to their networks. Last October, he gave a speech in which he pitched exactly that:

Drawing an analogy to how the military detects an incoming missile with radar and other sensors, Alexander imagined the NSA being able to spot "a cyberpacket that's about to destroy Wall Street." In an ideal world, he said, the agency would be getting real-time information from the banks themselves, as well as from the NSA's traditional channels of intelligence, and have the power to take action before a cyberattack caused major damage.

His proposed solution: Private companies should give the government access to their networks so it could screen out the harmful software. The NSA chief was offering to serve as an all-knowing virus-protection service, but at the cost, industry officials felt, of an unprecedented intrusion into the financial institutions’ databases.

The group of financial industry officials, sitting around a table at the Office of the Director of National Intelligence, were stunned, immediately grasping the privacy implications of what Alexander was politely but urgently suggesting. As a group, they demurred.

“He’s an impressive person,” the participant said, recalling the group’s collective reaction to Alexander. “You feel very comfortable with him. He instills a high degree of trust.”

But he was proposing something they thought was high-risk.

“Folks in the room looked at each other like, ‘Wow. That’s kind of wild.’ ”

This all should probably make you wonder why those very same financial institutions seem willing to shell out somewhere between $600,000 and $1 million per month for Alexander's "patent-pending" solutions to "cybersecurity."

Furthermore, this should shed some light on why the NSA was so in favor of CISPA and now CISA -- cybersecurity bills in Congress that would give private companies liability protections if they... shared network data with the NSA (and other parts of the federal government). The NSA needs those liability protections to get some companies to be willing to open up their networks to do this kind of MonsterMind offering, or they won't participate. It's also why Congress shouldn't pass such a bill.

We need a system that automatically ejects people from government positions when they: Violate the Constitution, are caught willfully lying (even least untruthful lies), and/or violate their oath of office.I think that should just about cover most things. Perhaps others could add to the list.

This kind of trouble has happened before

The dangers of such a 'MonsterMind' system remind me of a story of anti-spam software in the earlier days of the Internet.

The way the anti-spam software worked that one company made, if someone emails you a message their software sees as spam, their software will email 50 emails back to that person saying "Please take me off of your mailing list" or something to that effect, to spam the spammers back with useless junk so they don't email you again.

Sounds fine, until you take into account 1) false alarms that mark legitimate emails as spamand 2) the fact that the person who sent the 'spam' email might also have the exact same anti-spam software installed...

Needless to say, that company's anti-spam software managed to take down a few servers. Their software viewed their own 'please take me off of your mailing list' emails as spam, which caused an infinite loop of those emails to get sent back and forth, constantly increasing 50-fold because each new spam email had to get 50 new responses.

That company was later fined over their anti-spam software, for violating anti-spam laws.

Re: I'd forgotten that bit of crazy

Seriously. I can't believe Alexander considers himself worth hundreds of thousands of dollars, when even an amateur like me can tell he knows absolutely nothing about computers.Really, if he was just an obnoxious blowhard, he'd be using the technical terms just to show off. The fact that he keeps using made-up words ("cyberpacket"? really?) shows that he's a complete sham.

Yeah, because false alarms never happen at all. Hell, just this week I was hearing about a series of false alarms when the US thought that Russia had launched thousands of nuclear missiles at the US. Imagine an automated system taught to respond to that?

This suggests

This suggests that they had NO basic knowledge of BASIC protections on remote accessed computers.OR that the corps didnt want to enable them. just to have someone ELSE to blame for their OWN incompetence..

it's also why there should be no way to financially influence politics and both the donor and the recipient facing serious charges if they do. then add in an end to lobbying money and maybe, just maybe we could get some real politics and decision making done that genuinely benefits country and citizens!

There are two ways to launch an attack

1. Spend time and money (and other resources, like personnel) designing a weapons system. Do research. Do development. Do fabrication and deployment. Do targeting. Do fire control. Do damage assessment.

This can be very expensive and tedious, not to mention personally risky and subject to interruption by people who would very much NOT like you to develop a weapons system. Fortunately, there is another way:

2. Let someone else do everything in (1), and then deceive/provoke them into attacking the target of your choice. This is far cheaper and easier, plus they'll probably be blamed for it.

Offensive network/system attacks are a very stupid idea, which is people like me have been saying for decades that it is never appropriate to respond to abuse with abuse. Automatic offensive attacks are an insanely stupid idea. Apparently some of the slow learners in the class need some remedial education basic security principles.

Why are we hiring Alexander again?

Isn't it truly amazing how on the one hand you can be certain that (as revealed here) every company's network must be under NSA surveillance and any NSA employee (current or former) who interferes with those aims and goals is a traitor...

...and then when you resign you are just as certain that interfering with NSA's aims and goals is "good and profitable business" and that you are a lily-white patriot?

So it seems either he's a dyed in the wool hypocrite, or you can't trust him near any of your company's computers. If I owned a company, and he told me the sky was blue or that hammers released in a gravity field fall, I'd triple-check before I paid him a dime.

Soooo...now let's take a second look at the companies that signed up for his services. Maybe they're hiring him knowingly to set up company (and government) surveillance on their customers? Military-industrial complex in action?

I am wondering why the revelations in this article and those immediately preceding it are presented as hearsay and without any substantiating documentation? Maybe they are completely true, but their presentation as unsubstantiated hearsay makes me a bit suspicious.